

<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  
  <title>yubihsm.core &mdash; python-yubihsm 2.1.0 documentation</title>
  

  
  <link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

  
  
    <link rel="shortcut icon" href="../../_static/favicon.ico"/>
  

  
  

  

  
  <!--[if lt IE 9]>
    <script src="../../_static/js/html5shiv.min.js"></script>
  <![endif]-->
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
        <script src="../../_static/jquery.js"></script>
        <script src="../../_static/underscore.js"></script>
        <script src="../../_static/doctools.js"></script>
    
    <script type="text/javascript" src="../../_static/js/theme.js"></script>

    
    <link rel="index" title="Index" href="../../genindex.html" />
    <link rel="search" title="Search" href="../../search.html" /> 
</head>

<body class="wy-body-for-nav">

   
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >
          

          
            <a href="../../index.html" class="icon icon-home"> python-yubihsm
          

          
          </a>

          
            
            
              <div class="version">
                2.1
              </div>
            
          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        
        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <!-- Local TOC -->
              <div class="local-toc"></div>
            
          
        </div>
        
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../../index.html">python-yubihsm</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          

















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
        
          <li><a href="../index.html">Module code</a> &raquo;</li>
        
      <li>yubihsm.core</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
      </li>
    
  </ul>

  
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <h1>Source code for yubihsm.core</h1><div class="highlight"><pre>
<span></span><span class="c1"># Copyright 2016-2018 Yubico AB</span>
<span class="c1">#</span>
<span class="c1"># Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);</span>
<span class="c1"># you may not use this file except in compliance with the License.</span>
<span class="c1"># You may obtain a copy of the License at</span>
<span class="c1">#</span>
<span class="c1">#     http://www.apache.org/licenses/LICENSE-2.0</span>
<span class="c1">#</span>
<span class="c1"># Unless required by applicable law or agreed to in writing, software</span>
<span class="c1"># distributed under the License is distributed on an &quot;AS IS&quot; BASIS,</span>
<span class="c1"># WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.</span>
<span class="c1"># See the License for the specific language governing permissions and</span>
<span class="c1"># limitations under the License.</span>

<span class="sd">&quot;&quot;&quot;Core classes for YubiHSM communication.&quot;&quot;&quot;</span>


<span class="kn">from</span> <span class="nn">__future__</span> <span class="kn">import</span> <span class="n">absolute_import</span><span class="p">,</span> <span class="n">division</span>

<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">utils</span>
<span class="kn">from</span> <span class="nn">.defs</span> <span class="kn">import</span> <span class="n">COMMAND</span><span class="p">,</span> <span class="n">ALGORITHM</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="p">,</span> <span class="n">OPTION</span><span class="p">,</span> <span class="n">AUDIT</span>
<span class="kn">from</span> <span class="nn">.backends</span> <span class="kn">import</span> <span class="n">get_backend</span>
<span class="kn">from</span> <span class="nn">.objects</span> <span class="kn">import</span> <span class="n">YhsmObject</span><span class="p">,</span> <span class="n">_label_pack</span><span class="p">,</span> <span class="n">LABEL_LENGTH</span>
<span class="kn">from</span> <span class="nn">.exceptions</span> <span class="kn">import</span> <span class="p">(</span>
    <span class="n">YubiHsmDeviceError</span><span class="p">,</span>
    <span class="n">YubiHsmInvalidRequestError</span><span class="p">,</span>
    <span class="n">YubiHsmInvalidResponseError</span><span class="p">,</span>
    <span class="n">YubiHsmAuthenticationError</span><span class="p">,</span>
    <span class="n">YubiHsmConnectionError</span><span class="p">,</span>
<span class="p">)</span>

<span class="kn">from</span> <span class="nn">cryptography.hazmat.backends</span> <span class="kn">import</span> <span class="n">default_backend</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives</span> <span class="kn">import</span> <span class="n">cmac</span><span class="p">,</span> <span class="n">constant_time</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives.ciphers</span> <span class="kn">import</span> <span class="n">Cipher</span><span class="p">,</span> <span class="n">algorithms</span><span class="p">,</span> <span class="n">modes</span>
<span class="kn">from</span> <span class="nn">cryptography.utils</span> <span class="kn">import</span> <span class="n">int_to_bytes</span>
<span class="kn">from</span> <span class="nn">hashlib</span> <span class="kn">import</span> <span class="n">sha256</span>
<span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">namedtuple</span>
<span class="kn">import</span> <span class="nn">os</span>
<span class="kn">import</span> <span class="nn">six</span>
<span class="kn">import</span> <span class="nn">struct</span>


<span class="n">KEY_ENC</span> <span class="o">=</span> <span class="mh">0x04</span>
<span class="n">KEY_MAC</span> <span class="o">=</span> <span class="mh">0x06</span>
<span class="n">KEY_RMAC</span> <span class="o">=</span> <span class="mh">0x07</span>
<span class="n">CARD_CRYPTOGRAM</span> <span class="o">=</span> <span class="mh">0x00</span>
<span class="n">HOST_CRYPTOGRAM</span> <span class="o">=</span> <span class="mh">0x01</span>

<span class="n">MAX_MSG_SIZE</span> <span class="o">=</span> <span class="mi">2048</span> <span class="o">-</span> <span class="mi">1</span>


<span class="k">def</span> <span class="nf">_derive</span><span class="p">(</span><span class="n">key</span><span class="p">,</span> <span class="n">t</span><span class="p">,</span> <span class="n">context</span><span class="p">,</span> <span class="n">L</span><span class="o">=</span><span class="mh">0x80</span><span class="p">):</span>
    <span class="c1"># this only supports aes128</span>
    <span class="k">if</span> <span class="n">L</span> <span class="o">!=</span> <span class="mh">0x80</span> <span class="ow">and</span> <span class="n">L</span> <span class="o">!=</span> <span class="mh">0x40</span><span class="p">:</span>
        <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;L must be 0x40 or 0x80&quot;</span><span class="p">)</span>

    <span class="n">i</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\0</span><span class="s2">&quot;</span> <span class="o">*</span> <span class="mi">11</span> <span class="o">+</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BBHB&quot;</span><span class="p">,</span> <span class="n">t</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">L</span><span class="p">,</span> <span class="mi">1</span><span class="p">)</span> <span class="o">+</span> <span class="n">context</span>

    <span class="n">c</span> <span class="o">=</span> <span class="n">cmac</span><span class="o">.</span><span class="n">CMAC</span><span class="p">(</span><span class="n">algorithms</span><span class="o">.</span><span class="n">AES</span><span class="p">(</span><span class="n">key</span><span class="p">),</span> <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">())</span>
    <span class="n">c</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">i</span><span class="p">)</span>
    <span class="k">return</span> <span class="n">c</span><span class="o">.</span><span class="n">finalize</span><span class="p">()[:</span> <span class="n">L</span> <span class="o">//</span> <span class="mi">8</span><span class="p">]</span>


<span class="k">def</span> <span class="nf">_unpad_resp</span><span class="p">(</span><span class="n">resp</span><span class="p">,</span> <span class="n">cmd</span><span class="p">):</span>
    <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">resp</span><span class="p">)</span> <span class="o">&lt;</span> <span class="mi">3</span><span class="p">:</span>
        <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Wrong length&quot;</span><span class="p">)</span>
    <span class="n">rcmd</span><span class="p">,</span> <span class="n">length</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">resp</span><span class="p">[:</span><span class="mi">3</span><span class="p">])</span>
    <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">resp</span><span class="p">)</span> <span class="o">&lt;</span> <span class="n">length</span> <span class="o">+</span> <span class="mi">3</span><span class="p">:</span>
        <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Wrong length&quot;</span><span class="p">)</span>
    <span class="k">if</span> <span class="n">rcmd</span> <span class="o">==</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">ERROR</span><span class="p">:</span>
        <span class="k">raise</span> <span class="n">YubiHsmDeviceError</span><span class="p">(</span><span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">resp</span><span class="p">,</span> <span class="mi">3</span><span class="p">))</span>
    <span class="k">elif</span> <span class="n">rcmd</span> <span class="o">!=</span> <span class="n">cmd</span> <span class="o">|</span> <span class="mh">0x80</span><span class="p">:</span>
        <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Wrong command in response&quot;</span><span class="p">)</span>
    <span class="k">return</span> <span class="n">resp</span><span class="p">[</span><span class="mi">3</span> <span class="p">:</span> <span class="n">length</span> <span class="o">+</span> <span class="mi">3</span><span class="p">]</span>


<div class="viewcode-block" id="YubiHsm"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm">[docs]</a><span class="k">class</span> <span class="nc">YubiHsm</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;An unauthenticated connection to a YubiHSM.&quot;&quot;&quot;</span>

    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">backend</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Constructs a YubiHSM connected to the given backend.</span>

<span class="sd">        :param backend: A backend used to communicate with a YubiHSM.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_backend</span> <span class="o">=</span> <span class="n">backend</span>

    <span class="k">def</span> <span class="fm">__enter__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="bp">self</span>

    <span class="k">def</span> <span class="fm">__exit__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">typ</span><span class="p">,</span> <span class="n">value</span><span class="p">,</span> <span class="n">traceback</span><span class="p">):</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>

<div class="viewcode-block" id="YubiHsm.close"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.close">[docs]</a>    <span class="k">def</span> <span class="nf">close</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Disconnect from the backend, freeing any resources in use by it.&quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_backend</span><span class="p">:</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_backend</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_backend</span> <span class="o">=</span> <span class="kc">None</span></div>

    <span class="k">def</span> <span class="nf">_transceive</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">msg</span><span class="p">):</span>
        <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">MAX_MSG_SIZE</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidRequestError</span><span class="p">(</span><span class="s2">&quot;Message too long.&quot;</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_backend</span><span class="o">.</span><span class="n">transceive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>

<div class="viewcode-block" id="YubiHsm.send_cmd"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.send_cmd">[docs]</a>    <span class="k">def</span> <span class="nf">send_cmd</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">cmd</span><span class="p">,</span> <span class="n">data</span><span class="o">=</span><span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Encode and send a command byte and its associated data.</span>

<span class="sd">        :param COMMAND cmd: The command to send.</span>
<span class="sd">        :param bytes data: The command payload to send.</span>
<span class="sd">        :return: The response data from the YubiHSM.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">cmd</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="n">_unpad_resp</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_transceive</span><span class="p">(</span><span class="n">msg</span><span class="p">),</span> <span class="n">cmd</span><span class="p">)</span></div>

<div class="viewcode-block" id="YubiHsm.get_device_info"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.get_device_info">[docs]</a>    <span class="k">def</span> <span class="nf">get_device_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get general device information from the YubiHSM.</span>

<span class="sd">        :return: Device information.</span>
<span class="sd">        :rtype: DeviceInfo</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">DeviceInfo</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">send_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DEVICE_INFO</span><span class="p">))</span></div>

<div class="viewcode-block" id="YubiHsm.create_session"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.create_session">[docs]</a>    <span class="k">def</span> <span class="nf">create_session</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">auth_key_id</span><span class="p">,</span> <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Creates an authenticated session with the YubiHSM.</span>

<span class="sd">        See also create_session_derived, which derives K-ENC and K-MAC from a</span>
<span class="sd">        password.</span>

<span class="sd">        :param int auth_key_id: The ID of the Authentication key used to</span>
<span class="sd">            authenticate the session.</span>
<span class="sd">        :param bytes key_enc: Static K-ENC used to establish session.</span>
<span class="sd">        :param bytes key_mac: Static K-MAC used to establish session.</span>
<span class="sd">        :return: An authenticated session.</span>
<span class="sd">        :rtype: AuthSession</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">AuthSession</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">auth_key_id</span><span class="p">,</span> <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">)</span></div>

<div class="viewcode-block" id="YubiHsm.create_session_derived"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.create_session_derived">[docs]</a>    <span class="k">def</span> <span class="nf">create_session_derived</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">auth_key_id</span><span class="p">,</span> <span class="n">password</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Creates an authenticated session with the YubiHSM.</span>

<span class="sd">        Uses a supplied password to derive the keys K-ENC and K-MAC.</span>

<span class="sd">        :param int auth_key_id: The ID of the Authentication key used to</span>
<span class="sd">            authenticate the session.</span>
<span class="sd">        :param str password: The password used to derive the keys from.</span>
<span class="sd">        :return: An authenticated session.</span>
<span class="sd">        :rtype: AuthSession</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span> <span class="o">=</span> <span class="n">utils</span><span class="o">.</span><span class="n">password_to_key</span><span class="p">(</span><span class="n">password</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">create_session</span><span class="p">(</span><span class="n">auth_key_id</span><span class="p">,</span> <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">)</span></div>

<div class="viewcode-block" id="YubiHsm.connect"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.YubiHsm.connect">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">connect</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">url</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Return a YubiHsm connected to the backend specified by the URL.</span>

<span class="sd">        If no URL is given this will attempt to connect to a YubiHSM connector</span>
<span class="sd">        running on localhost, using the default port.</span>

<span class="sd">        :param str url: (optional) A http(s):// or yhusb:// backend URL.</span>
<span class="sd">        :return: A YubiHsm instance connected to the backend referenced by the</span>
<span class="sd">            url.</span>
<span class="sd">        :rtype: YubiHsm</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">get_backend</span><span class="p">(</span><span class="n">url</span><span class="p">))</span></div>

    <span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="s2">&quot;</span><span class="si">{0.__class__.__name__}</span><span class="s2">(</span><span class="si">{0._backend}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span></div>


<span class="k">class</span> <span class="nc">_UnknownIntEnum</span><span class="p">(</span><span class="nb">int</span><span class="p">):</span>
    <span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;UNKNOWN&quot;</span>

    <span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="s2">&quot;&lt;</span><span class="si">%s</span><span class="s2">: </span><span class="si">%d</span><span class="s2">&gt;&quot;</span> <span class="o">%</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>

    <span class="k">def</span> <span class="fm">__str__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span>

    <span class="nd">@property</span>
    <span class="k">def</span> <span class="nf">value</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="nb">int</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>


<span class="k">class</span> <span class="nc">_UnknownAlgorithm</span><span class="p">(</span><span class="n">_UnknownIntEnum</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Wrapper for unknown ALGORITHM values.</span>

<span class="sd">    Provides obj.name, obj.value and and string representations.&quot;&quot;&quot;</span>

    <span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;ALGORITHM.UNKNOWN&quot;</span>


<span class="k">def</span> <span class="nf">_algorithm</span><span class="p">(</span><span class="n">val</span><span class="p">):</span>
    <span class="k">try</span><span class="p">:</span>
        <span class="k">return</span> <span class="n">ALGORITHM</span><span class="p">(</span><span class="n">val</span><span class="p">)</span>
    <span class="k">except</span> <span class="ne">ValueError</span><span class="p">:</span>
        <span class="k">return</span> <span class="n">_UnknownAlgorithm</span><span class="p">(</span><span class="n">val</span><span class="p">)</span>


<span class="k">class</span> <span class="nc">_UnknownCommand</span><span class="p">(</span><span class="n">_UnknownIntEnum</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Wrapper for unknown COMMAND values.</span>

<span class="sd">    Provides obj.name, obj.value and and string representations.&quot;&quot;&quot;</span>

    <span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;COMMAND.UNKNOWN&quot;</span>


<div class="viewcode-block" id="DeviceInfo"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.DeviceInfo">[docs]</a><span class="k">class</span> <span class="nc">DeviceInfo</span><span class="p">(</span>
    <span class="n">namedtuple</span><span class="p">(</span>
        <span class="s2">&quot;DeviceInfo&quot;</span><span class="p">,</span>
        <span class="p">[</span><span class="s2">&quot;version&quot;</span><span class="p">,</span> <span class="s2">&quot;serial&quot;</span><span class="p">,</span> <span class="s2">&quot;log_size&quot;</span><span class="p">,</span> <span class="s2">&quot;log_used&quot;</span><span class="p">,</span> <span class="s2">&quot;supported_algorithms&quot;</span><span class="p">],</span>
    <span class="p">)</span>
<span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Data class holding various information about the YubiHSM.</span>

<span class="sd">    :param version: YubiHSM version tuple.</span>
<span class="sd">    :type version: tuple[int, int, int]</span>
<span class="sd">    :param int serial: YubiHSM serial number.</span>
<span class="sd">    :param int log_size: Log entry storage capacity.</span>
<span class="sd">    :param int log_used: Log entries currently stored.</span>
<span class="sd">    :param set[ALGORITHM] supported_algorithms: List of supported algorithms.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="vm">__slots__</span> <span class="o">=</span> <span class="p">()</span>
    <span class="n">FORMAT</span> <span class="o">=</span> <span class="s2">&quot;!BBBIBB&quot;</span>
    <span class="n">LENGTH</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">calcsize</span><span class="p">(</span><span class="n">FORMAT</span><span class="p">)</span>

<div class="viewcode-block" id="DeviceInfo.parse"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.DeviceInfo.parse">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">parse</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Parse a DeviceInfo from its binary representation.</span>

<span class="sd">        :param bytes data: Binary data to unpack from.</span>
<span class="sd">        :return: The parsed object.</span>
<span class="sd">        :rtype: DeviceInfo</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">unpacked</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack_from</span><span class="p">(</span><span class="bp">cls</span><span class="o">.</span><span class="n">FORMAT</span><span class="p">,</span> <span class="n">data</span><span class="p">)</span>
        <span class="n">version</span> <span class="o">=</span> <span class="n">unpacked</span><span class="p">[:</span><span class="mi">3</span><span class="p">]</span>
        <span class="n">serial</span><span class="p">,</span> <span class="n">log_size</span><span class="p">,</span> <span class="n">log_used</span> <span class="o">=</span> <span class="n">unpacked</span><span class="p">[</span><span class="mi">3</span><span class="p">:]</span>
        <span class="n">algorithms</span> <span class="o">=</span> <span class="p">{</span><span class="n">_algorithm</span><span class="p">(</span><span class="n">a</span><span class="p">)</span> <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="n">six</span><span class="o">.</span><span class="n">iterbytes</span><span class="p">(</span><span class="n">data</span><span class="p">[</span><span class="bp">cls</span><span class="o">.</span><span class="n">LENGTH</span> <span class="p">:])}</span>

        <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">version</span><span class="p">,</span> <span class="n">serial</span><span class="p">,</span> <span class="n">log_size</span><span class="p">,</span> <span class="n">log_used</span><span class="p">,</span> <span class="n">algorithms</span><span class="p">)</span></div></div>


<span class="k">def</span> <span class="nf">_calculate_iv</span><span class="p">(</span><span class="n">key</span><span class="p">,</span> <span class="n">counter</span><span class="p">):</span>
    <span class="n">encryptor</span> <span class="o">=</span> <span class="n">Cipher</span><span class="p">(</span>
        <span class="n">algorithms</span><span class="o">.</span><span class="n">AES</span><span class="p">(</span><span class="n">key</span><span class="p">),</span> <span class="n">modes</span><span class="o">.</span><span class="n">ECB</span><span class="p">(),</span> <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">()</span>  <span class="c1"># nosec ECB</span>
    <span class="p">)</span><span class="o">.</span><span class="n">encryptor</span><span class="p">()</span>
    <span class="k">return</span> <span class="n">encryptor</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">int_to_bytes</span><span class="p">(</span><span class="n">counter</span><span class="p">,</span> <span class="mi">16</span><span class="p">))</span> <span class="o">+</span> <span class="n">encryptor</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>


<span class="k">def</span> <span class="nf">_calculate_mac</span><span class="p">(</span><span class="n">key</span><span class="p">,</span> <span class="n">chain</span><span class="p">,</span> <span class="n">message</span><span class="p">):</span>
    <span class="n">c</span> <span class="o">=</span> <span class="n">cmac</span><span class="o">.</span><span class="n">CMAC</span><span class="p">(</span><span class="n">algorithms</span><span class="o">.</span><span class="n">AES</span><span class="p">(</span><span class="n">key</span><span class="p">),</span> <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">())</span>
    <span class="n">c</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">chain</span><span class="p">)</span>
    <span class="n">c</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">message</span><span class="p">)</span>
    <span class="n">chain</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>
    <span class="k">return</span> <span class="n">chain</span><span class="p">,</span> <span class="n">chain</span><span class="p">[:</span><span class="mi">8</span><span class="p">]</span>


<div class="viewcode-block" id="AuthSession"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession">[docs]</a><span class="k">class</span> <span class="nc">AuthSession</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;An authenticated secure session with a YubiHSM.</span>

<span class="sd">    Typically you get an instance of this class by calling</span>
<span class="sd">    :func:`~YubiHsm.create_session` or :func:`~YubiHsm.create_session_derived`.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">hsm</span><span class="p">,</span> <span class="n">auth_key_id</span><span class="p">,</span> <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Constructs an authenticated session.</span>

<span class="sd">        :param YubiHsm hsm: The YubiHSM connection.</span>
<span class="sd">        :param int auth_key_id: The ID of the Authentication key used to</span>
<span class="sd">            authenticate the session.</span>
<span class="sd">        :param bytes key_enc: Static `K-ENC` used to establish the session.</span>
<span class="sd">        :param bytes key_mac: Static `K-MAC` used to establish the session.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_hsm</span> <span class="o">=</span> <span class="n">hsm</span>

        <span class="n">context</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">urandom</span><span class="p">(</span><span class="mi">8</span><span class="p">)</span>

        <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_hsm</span><span class="o">.</span><span class="n">send_cmd</span><span class="p">(</span>
            <span class="n">COMMAND</span><span class="o">.</span><span class="n">CREATE_SESSION</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="n">auth_key_id</span><span class="p">)</span> <span class="o">+</span> <span class="n">context</span>
        <span class="p">)</span>

        <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span> <span class="o">=</span> <span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
        <span class="n">context</span> <span class="o">+=</span> <span class="n">data</span><span class="p">[</span><span class="mi">1</span> <span class="p">:</span> <span class="mi">1</span> <span class="o">+</span> <span class="mi">8</span><span class="p">]</span>
        <span class="n">card_crypto</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="mi">9</span> <span class="p">:</span> <span class="mi">9</span> <span class="o">+</span> <span class="mi">8</span><span class="p">]</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_key_enc</span> <span class="o">=</span> <span class="n">_derive</span><span class="p">(</span><span class="n">key_enc</span><span class="p">,</span> <span class="n">KEY_ENC</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span> <span class="o">=</span> <span class="n">_derive</span><span class="p">(</span><span class="n">key_mac</span><span class="p">,</span> <span class="n">KEY_MAC</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_key_rmac</span> <span class="o">=</span> <span class="n">_derive</span><span class="p">(</span><span class="n">key_mac</span><span class="p">,</span> <span class="n">KEY_RMAC</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
        <span class="n">gen_card_crypto</span> <span class="o">=</span> <span class="n">_derive</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span><span class="p">,</span> <span class="n">CARD_CRYPTOGRAM</span><span class="p">,</span> <span class="n">context</span><span class="p">,</span> <span class="mh">0x40</span><span class="p">)</span>

        <span class="k">if</span> <span class="ow">not</span> <span class="n">constant_time</span><span class="o">.</span><span class="n">bytes_eq</span><span class="p">(</span><span class="n">gen_card_crypto</span><span class="p">,</span> <span class="n">card_crypto</span><span class="p">):</span>
            <span class="k">raise</span> <span class="n">YubiHsmAuthenticationError</span><span class="p">()</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BHB&quot;</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">AUTHENTICATE_SESSION</span><span class="p">,</span> <span class="mi">1</span> <span class="o">+</span> <span class="mi">8</span> <span class="o">+</span> <span class="mi">8</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">sid</span><span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">_derive</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span><span class="p">,</span> <span class="n">HOST_CRYPTOGRAM</span><span class="p">,</span> <span class="n">context</span><span class="p">,</span> <span class="mh">0x40</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_ctr</span> <span class="o">=</span> <span class="mi">1</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_mac_chain</span><span class="p">,</span> <span class="n">mac</span> <span class="o">=</span> <span class="n">_calculate_mac</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span><span class="p">,</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\0</span><span class="s2">&quot;</span> <span class="o">*</span> <span class="mi">16</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">mac</span>
        <span class="k">if</span> <span class="n">_unpad_resp</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_hsm</span><span class="o">.</span><span class="n">_transceive</span><span class="p">(</span><span class="n">msg</span><span class="p">),</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">AUTHENTICATE_SESSION</span><span class="p">)</span> <span class="o">!=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Non-empty response&quot;</span><span class="p">)</span>

<div class="viewcode-block" id="AuthSession.close"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.close">[docs]</a>    <span class="k">def</span> <span class="nf">close</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Close this session with the YubiHSM.</span>

<span class="sd">        Once closed, this session object can no longer be used, unless re-connected.</span>
<span class="sd">        &quot;&quot;&quot;</span>

        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="k">try</span><span class="p">:</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">CLOSE_SESSION</span><span class="p">)</span>
            <span class="k">finally</span><span class="p">:</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span> <span class="o">=</span> <span class="kc">None</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">_key_enc</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_key_rmac</span> <span class="o">=</span> <span class="kc">None</span></div>

    <span class="k">def</span> <span class="fm">__enter__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="bp">self</span>

    <span class="k">def</span> <span class="fm">__exit__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">typ</span><span class="p">,</span> <span class="n">value</span><span class="p">,</span> <span class="n">traceback</span><span class="p">):</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>

    <span class="k">def</span> <span class="nf">_secure_transceive</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">msg</span><span class="p">):</span>
        <span class="n">padlen</span> <span class="o">=</span> <span class="mi">15</span> <span class="o">-</span> <span class="nb">len</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span> <span class="o">%</span> <span class="mi">16</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x80</span><span class="s2">&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">msg</span><span class="o">.</span><span class="n">ljust</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span> <span class="o">+</span> <span class="n">padlen</span><span class="p">,</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\0</span><span class="s2">&quot;</span><span class="p">)</span>

        <span class="n">wrapped</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!BHB&quot;</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">SESSION_MESSAGE</span><span class="p">,</span> <span class="mi">1</span> <span class="o">+</span> <span class="nb">len</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span> <span class="o">+</span> <span class="mi">8</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">sid</span>
        <span class="p">)</span>
        <span class="n">cipher</span> <span class="o">=</span> <span class="n">Cipher</span><span class="p">(</span>
            <span class="n">algorithms</span><span class="o">.</span><span class="n">AES</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_enc</span><span class="p">),</span>
            <span class="n">modes</span><span class="o">.</span><span class="n">CBC</span><span class="p">(</span><span class="n">_calculate_iv</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_enc</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_ctr</span><span class="p">)),</span>
            <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">(),</span>
        <span class="p">)</span>
        <span class="n">encryptor</span> <span class="o">=</span> <span class="n">cipher</span><span class="o">.</span><span class="n">encryptor</span><span class="p">()</span>
        <span class="n">wrapped</span> <span class="o">+=</span> <span class="n">encryptor</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span> <span class="o">+</span> <span class="n">encryptor</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>
        <span class="n">next_mac_chain</span><span class="p">,</span> <span class="n">mac</span> <span class="o">=</span> <span class="n">_calculate_mac</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_mac_chain</span><span class="p">,</span> <span class="n">wrapped</span><span class="p">)</span>
        <span class="n">wrapped</span> <span class="o">+=</span> <span class="n">mac</span>
        <span class="n">raw_resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_hsm</span><span class="o">.</span><span class="n">_transceive</span><span class="p">(</span><span class="n">wrapped</span><span class="p">)</span>

        <span class="n">data</span> <span class="o">=</span> <span class="n">_unpad_resp</span><span class="p">(</span><span class="n">raw_resp</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">SESSION_MESSAGE</span><span class="p">)</span>

        <span class="k">if</span> <span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span> <span class="o">!=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Incorrect SID&quot;</span><span class="p">)</span>

        <span class="n">rmac</span> <span class="o">=</span> <span class="n">_calculate_mac</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_key_rmac</span><span class="p">,</span> <span class="n">next_mac_chain</span><span class="p">,</span> <span class="n">raw_resp</span><span class="p">[:</span><span class="o">-</span><span class="mi">8</span><span class="p">])[</span><span class="mi">1</span><span class="p">]</span>
        <span class="k">if</span> <span class="ow">not</span> <span class="n">constant_time</span><span class="o">.</span><span class="n">bytes_eq</span><span class="p">(</span><span class="n">raw_resp</span><span class="p">[</span><span class="o">-</span><span class="mi">8</span><span class="p">:],</span> <span class="n">rmac</span><span class="p">):</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Incorrect MAC&quot;</span><span class="p">)</span>

        <span class="bp">self</span><span class="o">.</span><span class="n">_ctr</span> <span class="o">+=</span> <span class="mi">1</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_mac_chain</span> <span class="o">=</span> <span class="n">next_mac_chain</span>

        <span class="n">decryptor</span> <span class="o">=</span> <span class="n">cipher</span><span class="o">.</span><span class="n">decryptor</span><span class="p">()</span>
        <span class="k">return</span> <span class="n">decryptor</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">data</span><span class="p">[</span><span class="mi">1</span><span class="p">:</span><span class="o">-</span><span class="mi">8</span><span class="p">])</span> <span class="o">+</span> <span class="n">decryptor</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>

    <span class="nd">@property</span>
    <span class="k">def</span> <span class="nf">sid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Session ID</span>

<span class="sd">        :return: The ID of the session.</span>
<span class="sd">        :rtype: int</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span>

<div class="viewcode-block" id="AuthSession.send_secure_cmd"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.send_secure_cmd">[docs]</a>    <span class="k">def</span> <span class="nf">send_secure_cmd</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">cmd</span><span class="p">,</span> <span class="n">data</span><span class="o">=</span><span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Send a command over the encrypted session.</span>

<span class="sd">        :param COMMAND cmd: The command to send.</span>
<span class="sd">        :param bytes data: The command payload to send.</span>
<span class="sd">        :return: The decrypted response data from the YubiHSM.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">cmd</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="n">_unpad_resp</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_secure_transceive</span><span class="p">(</span><span class="n">msg</span><span class="p">),</span> <span class="n">cmd</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.list_objects"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.list_objects">[docs]</a>    <span class="k">def</span> <span class="nf">list_objects</span><span class="p">(</span>
        <span class="bp">self</span><span class="p">,</span>
        <span class="n">object_id</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
        <span class="n">object_type</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
        <span class="n">domains</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
        <span class="n">algorithm</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
        <span class="n">label</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;List objects from the YubiHSM.</span>

<span class="sd">        This returns a list of all objects currently stored on the YubiHSM,</span>
<span class="sd">        which are accessible by this session. The arguments to this method can</span>
<span class="sd">        be used to filter the results returned.</span>

<span class="sd">        :param int object_id: (optional) Return only objects with this ID.</span>
<span class="sd">        :param OBJECT object_type: (optional) Return only objects of this type.</span>
<span class="sd">        :param int domains: (optional) Return only objects belonging to one or</span>
<span class="sd">            more of these domains.</span>
<span class="sd">        :param int capabilities: (optional) Return only objects with one or more</span>
<span class="sd">            of these capabilities.</span>
<span class="sd">        :param ALGORITHM algorithm: (optional) Return only objects with this</span>
<span class="sd">            algorithm.</span>
<span class="sd">        :param label: (optional) Return only objects with this label.</span>
<span class="sd">        :return: A list of matched objects.</span>
<span class="sd">        :rtype: list</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span>
        <span class="k">if</span> <span class="n">object_id</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">ID</span><span class="p">,</span> <span class="n">object_id</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">object_type</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BB&quot;</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">TYPE</span><span class="p">,</span> <span class="n">object_type</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">domains</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">DOMAINS</span><span class="p">,</span> <span class="n">domains</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">capabilities</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BQ&quot;</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">CAPABILITIES</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">algorithm</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BB&quot;</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">ALGORITHM</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">label</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
            <span class="n">msg</span> <span class="o">+=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
                <span class="s2">&quot;!B</span><span class="si">%d</span><span class="s2">s&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span> <span class="n">LIST_FILTER</span><span class="o">.</span><span class="n">LABEL</span><span class="p">,</span> <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">)</span>
            <span class="p">)</span>

        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">LIST_OBJECTS</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>

        <span class="n">objects</span> <span class="o">=</span> <span class="p">[]</span>
        <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">resp</span><span class="p">),</span> <span class="mi">4</span><span class="p">):</span>
            <span class="n">object_id</span><span class="p">,</span> <span class="n">typ</span><span class="p">,</span> <span class="n">seq</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!HBB&quot;</span><span class="p">,</span> <span class="n">resp</span><span class="p">[</span><span class="n">i</span> <span class="p">:</span> <span class="n">i</span> <span class="o">+</span> <span class="mi">4</span><span class="p">])</span>
            <span class="n">objects</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">YhsmObject</span><span class="o">.</span><span class="n">_create</span><span class="p">(</span><span class="n">typ</span><span class="p">,</span> <span class="bp">self</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">seq</span><span class="p">))</span>
        <span class="k">return</span> <span class="n">objects</span></div>

<div class="viewcode-block" id="AuthSession.get_object"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_object">[docs]</a>    <span class="k">def</span> <span class="nf">get_object</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">object_type</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get a reference to a YhsmObject with the given id and type.</span>

<span class="sd">        The object returned will be a subclass of YhsmObject corresponding to</span>
<span class="sd">        the given object_type.</span>

<span class="sd">        :param int object_id: The ID of the object to retrieve.</span>
<span class="sd">        :param OBJECT object_type: The type of the object to retrieve.</span>
<span class="sd">        :return: An object reference.</span>
<span class="sd">        :rtype: YhsmObject</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">YhsmObject</span><span class="o">.</span><span class="n">_create</span><span class="p">(</span><span class="n">object_type</span><span class="p">,</span> <span class="bp">self</span><span class="p">,</span> <span class="n">object_id</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.get_pseudo_random"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_pseudo_random">[docs]</a>    <span class="k">def</span> <span class="nf">get_pseudo_random</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">length</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get bytes from YubiHSM PRNG.</span>

<span class="sd">        :param int length: The number of bytes to return.</span>
<span class="sd">        :return: The requested number of random bytes.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="n">length</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_PSEUDO_RANDOM</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.reset_device"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.reset_device">[docs]</a>    <span class="k">def</span> <span class="nf">reset_device</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Performs a factory reset of the YubiHSM.</span>

<span class="sd">        Resets and reboots the YubiHSM, deletes all Objects and restores the</span>
<span class="sd">        default Authkey.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">try</span><span class="p">:</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">RESET_DEVICE</span><span class="p">)</span> <span class="o">!=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">:</span>
                <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Non-empty response&quot;</span><span class="p">)</span>
        <span class="k">except</span> <span class="n">YubiHsmConnectionError</span><span class="p">:</span>
            <span class="k">pass</span>  <span class="c1"># Assume reset went well, it may interrupt the connection.</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_sid</span> <span class="o">=</span> <span class="kc">None</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_key_enc</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_key_mac</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_key_rmac</span> <span class="o">=</span> <span class="kc">None</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_hsm</span><span class="o">.</span><span class="n">close</span><span class="p">()</span></div>

<div class="viewcode-block" id="AuthSession.get_log_entries"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_log_entries">[docs]</a>    <span class="k">def</span> <span class="nf">get_log_entries</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">previous_entry</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get logs from the YubiHSM.</span>

<span class="sd">        This returns a tuple of the number of unlogged boot events, the number</span>
<span class="sd">        of unlogged authentication events, and the log entries from the YubiHSM.</span>
<span class="sd">        The chain of entry digests will be validated, starting from the first</span>
<span class="sd">        entry returned, or the one supplied as previous_entry.</span>

<span class="sd">        :param LogEntry previous_entry: (optional) Entry to start verification</span>
<span class="sd">            against.</span>
<span class="sd">        :return: A tuple consisting of the number of unlogged boot and</span>
<span class="sd">            authentication events, and the list of log entries.</span>
<span class="sd">        :rtype: LogData</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_LOG_ENTRIES</span><span class="p">)</span>
        <span class="n">boot</span><span class="p">,</span> <span class="n">auth</span><span class="p">,</span> <span class="n">num</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!HHB&quot;</span><span class="p">,</span> <span class="n">resp</span><span class="p">[:</span><span class="mi">5</span><span class="p">])</span>

        <span class="n">data</span> <span class="o">=</span> <span class="n">resp</span><span class="p">[</span><span class="mi">5</span><span class="p">:]</span>
        <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">)</span> <span class="o">!=</span> <span class="n">num</span> <span class="o">*</span> <span class="n">LogEntry</span><span class="o">.</span><span class="n">LENGTH</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Incorrect length&quot;</span><span class="p">)</span>

        <span class="n">logs</span> <span class="o">=</span> <span class="p">[]</span>
        <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">LogEntry</span><span class="o">.</span><span class="n">LENGTH</span><span class="p">):</span>
            <span class="n">entry</span> <span class="o">=</span> <span class="n">LogEntry</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span><span class="n">data</span><span class="p">[</span><span class="n">i</span> <span class="p">:</span> <span class="n">i</span> <span class="o">+</span> <span class="n">LogEntry</span><span class="o">.</span><span class="n">LENGTH</span><span class="p">])</span>
            <span class="k">if</span> <span class="n">previous_entry</span><span class="p">:</span>
                <span class="k">if</span> <span class="ow">not</span> <span class="n">entry</span><span class="o">.</span><span class="n">validate</span><span class="p">(</span><span class="n">previous_entry</span><span class="p">):</span>
                    <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Incorrect log digest&quot;</span><span class="p">)</span>
            <span class="n">logs</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">entry</span><span class="p">)</span>
            <span class="n">previous_entry</span> <span class="o">=</span> <span class="n">entry</span>

        <span class="k">return</span> <span class="n">LogData</span><span class="p">(</span><span class="n">boot</span><span class="p">,</span> <span class="n">auth</span><span class="p">,</span> <span class="n">logs</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.set_log_index"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.set_log_index">[docs]</a>    <span class="k">def</span> <span class="nf">set_log_index</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">index</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Clears logs to free up space for use with forced audit.</span>

<span class="sd">        :param int index: The log entry index to clear up to (inclusive).</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="n">index</span><span class="p">)</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SET_LOG_INDEX</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span> <span class="o">!=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Non-empty response&quot;</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.put_option"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.put_option">[docs]</a>    <span class="k">def</span> <span class="nf">put_option</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">option</span><span class="p">,</span> <span class="n">value</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Set the raw value of a YubiHSM device option.</span>

<span class="sd">        :param OPTION option: The OPTION to set.</span>
<span class="sd">        :param bytes value: The value to set the OPTION to.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">option</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">value</span><span class="p">))</span> <span class="o">+</span> <span class="n">value</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SET_OPTION</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span> <span class="o">!=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Non-empty response&quot;</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.get_option"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_option">[docs]</a>    <span class="k">def</span> <span class="nf">get_option</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">option</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get the raw value of a YubiHSM device option.</span>

<span class="sd">        :param OPTION option: The OPTION to get.</span>
<span class="sd">        :return: The currently set value for the given OPTION</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!B&quot;</span><span class="p">,</span> <span class="n">option</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_OPTION</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.set_force_audit"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.set_force_audit">[docs]</a>    <span class="k">def</span> <span class="nf">set_force_audit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">audit</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Set the FORCE_AUDIT mode of the YubiHSM.</span>

<span class="sd">        :param AUDIT audit: The AUDIT mode to set.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">put_option</span><span class="p">(</span><span class="n">OPTION</span><span class="o">.</span><span class="n">FORCE_AUDIT</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;B&quot;</span><span class="p">,</span> <span class="n">audit</span><span class="p">))</span></div>

<div class="viewcode-block" id="AuthSession.get_force_audit"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_force_audit">[docs]</a>    <span class="k">def</span> <span class="nf">get_force_audit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get the current setting for forced audit mode.</span>

<span class="sd">        :return: The AUDIT setting for FORCE_AUDIT.</span>
<span class="sd">        :rtype: AUDIT</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">AUDIT</span><span class="p">(</span><span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_option</span><span class="p">(</span><span class="n">OPTION</span><span class="o">.</span><span class="n">FORCE_AUDIT</span><span class="p">),</span> <span class="mi">0</span><span class="p">))</span></div>

<div class="viewcode-block" id="AuthSession.set_command_audit"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.set_command_audit">[docs]</a>    <span class="k">def</span> <span class="nf">set_command_audit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">commands</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Set audit mode of commands.</span>

<span class="sd">        Takes a dict of COMMAND -&gt; AUDIT pairs and updates the audit settings</span>
<span class="sd">        for the commands given.</span>

<span class="sd">        :param commands: Settings to update.</span>
<span class="sd">        :type commands: dict[COMMAND, AUDIT]</span>

<span class="sd">        :Example:</span>

<span class="sd">        &gt;&gt;&gt; session.set_comment_audit({</span>
<span class="sd">        ...     COMMAND.ECHO: AUDIT.OFF,</span>
<span class="sd">        ...     COMMAND.LIST_OBJECTS: AUDIT.ON</span>
<span class="sd">        ... })</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!BB&quot;</span><span class="p">,</span> <span class="n">k</span><span class="p">,</span> <span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="p">(</span><span class="n">k</span><span class="p">,</span> <span class="n">v</span><span class="p">)</span> <span class="ow">in</span> <span class="n">commands</span><span class="o">.</span><span class="n">items</span><span class="p">())</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">put_option</span><span class="p">(</span><span class="n">OPTION</span><span class="o">.</span><span class="n">COMMAND_AUDIT</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthSession.get_command_audit"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.AuthSession.get_command_audit">[docs]</a>    <span class="k">def</span> <span class="nf">get_command_audit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get a mapping of all available commands and their audit settings.</span>

<span class="sd">        :return: Dictionary of COMMAND -&gt; AUDIT pairs.</span>
<span class="sd">        :rtype: dict[COMMAND, AUDIT]</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_option</span><span class="p">(</span><span class="n">OPTION</span><span class="o">.</span><span class="n">COMMAND_AUDIT</span><span class="p">)</span>
        <span class="n">ret</span> <span class="o">=</span> <span class="p">{}</span>
        <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">resp</span><span class="p">),</span> <span class="mi">2</span><span class="p">):</span>
            <span class="n">cmd</span> <span class="o">=</span> <span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">resp</span><span class="p">,</span> <span class="n">i</span><span class="p">)</span>
            <span class="n">val</span> <span class="o">=</span> <span class="n">AUDIT</span><span class="p">(</span><span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">resp</span><span class="p">,</span> <span class="n">i</span> <span class="o">+</span> <span class="mi">1</span><span class="p">))</span>
            <span class="k">try</span><span class="p">:</span>
                <span class="n">ret</span><span class="p">[</span><span class="n">COMMAND</span><span class="p">(</span><span class="n">cmd</span><span class="p">)]</span> <span class="o">=</span> <span class="n">val</span>
            <span class="k">except</span> <span class="ne">ValueError</span><span class="p">:</span>
                <span class="n">ret</span><span class="p">[</span><span class="n">_UnknownCommand</span><span class="p">(</span><span class="n">cmd</span><span class="p">)]</span> <span class="o">=</span> <span class="n">val</span>
        <span class="k">return</span> <span class="n">ret</span></div>

    <span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="s2">&quot;</span><span class="si">{0.__class__.__name__}</span><span class="s2">(id=</span><span class="si">{0._sid}</span><span class="s2">, hsm=</span><span class="si">{0._hsm}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span></div>


<div class="viewcode-block" id="LogData"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.LogData">[docs]</a><span class="k">class</span> <span class="nc">LogData</span><span class="p">(</span><span class="n">namedtuple</span><span class="p">(</span><span class="s2">&quot;LogData&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;n_boot&quot;</span><span class="p">,</span> <span class="s2">&quot;n_auth&quot;</span><span class="p">,</span> <span class="s2">&quot;entries&quot;</span><span class="p">])):</span>
    <span class="sd">&quot;&quot;&quot;Data class holding response data from a GET_LOGS command.</span>

<span class="sd">    :param int n_boot: Number of unlogged boot events.</span>
<span class="sd">    :param int n_auth: Number of unlogged authentication events.</span>
<span class="sd">    :param list[LogEntry] entries: List of LogEntry items.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="vm">__slots__</span> <span class="o">=</span> <span class="p">()</span></div>


<div class="viewcode-block" id="LogEntry"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.LogEntry">[docs]</a><span class="k">class</span> <span class="nc">LogEntry</span><span class="p">(</span>
    <span class="n">namedtuple</span><span class="p">(</span>
        <span class="s2">&quot;LogEntry&quot;</span><span class="p">,</span>
        <span class="p">[</span>
            <span class="s2">&quot;number&quot;</span><span class="p">,</span>
            <span class="s2">&quot;command&quot;</span><span class="p">,</span>
            <span class="s2">&quot;length&quot;</span><span class="p">,</span>
            <span class="s2">&quot;session_key&quot;</span><span class="p">,</span>
            <span class="s2">&quot;target_key&quot;</span><span class="p">,</span>
            <span class="s2">&quot;second_key&quot;</span><span class="p">,</span>
            <span class="s2">&quot;result&quot;</span><span class="p">,</span>
            <span class="s2">&quot;tick&quot;</span><span class="p">,</span>
            <span class="s2">&quot;digest&quot;</span><span class="p">,</span>
        <span class="p">],</span>
    <span class="p">)</span>
<span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;YubiHSM log entry.</span>

<span class="sd">    :param int number: The sequence number of the entry.</span>
<span class="sd">    :param int command: The COMMAND executed.</span>
<span class="sd">    :param int length: The length of the command.</span>
<span class="sd">    :param int session_key: The ID of the Authentication Key for the session.</span>
<span class="sd">    :param int target_key: The ID of the key used by the command.</span>
<span class="sd">    :param int second_key: The ID of the secondary key used by the command, if</span>
<span class="sd">        applicable.</span>
<span class="sd">    :param int result: The result byte of the response.</span>
<span class="sd">    :param int tick: The YubiHSM system tick value when the command was run.</span>
<span class="sd">    :param bytes digest: A truncated hash of the entry and previous digest.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="vm">__slots__</span> <span class="o">=</span> <span class="p">()</span>
    <span class="n">FORMAT</span> <span class="o">=</span> <span class="s2">&quot;!HBHHHHBL16s&quot;</span>
    <span class="n">LENGTH</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">calcsize</span><span class="p">(</span><span class="n">FORMAT</span><span class="p">)</span>

    <span class="nd">@property</span>
    <span class="k">def</span> <span class="nf">data</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get log entry binary data.</span>

<span class="sd">        :return: The binary LogEntry data, excluding the digest.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">FORMAT</span><span class="p">,</span> <span class="o">*</span><span class="bp">self</span><span class="p">)[:</span><span class="o">-</span><span class="mi">16</span><span class="p">]</span>

<div class="viewcode-block" id="LogEntry.parse"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.LogEntry.parse">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">parse</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Parse a LogEntry from its binary representation.</span>

<span class="sd">        :param bytes data: Binary data to unpack from.</span>
<span class="sd">        :return: The parsed object.</span>
<span class="sd">        :rtype: LogEntry</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="o">*</span><span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="o">.</span><span class="n">FORMAT</span><span class="p">,</span> <span class="n">data</span><span class="p">))</span></div>

<div class="viewcode-block" id="LogEntry.validate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.core.LogEntry.validate">[docs]</a>    <span class="k">def</span> <span class="nf">validate</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">previous_entry</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Validate the hash of a single log entry.</span>

<span class="sd">        Validates the hash of this entry with regard to the previous entry&#39;s</span>
<span class="sd">        hash. The previous entry is the LogEntry with the previous number,</span>
<span class="sd">        previous_entry.number == self.number - 1</span>

<span class="sd">        :param LogEntry previous_entry: The previous log entry to validate</span>
<span class="sd">            against.</span>
<span class="sd">        :return: True if the digest is correct, False if not.</span>
<span class="sd">        :rtype: bool</span>
<span class="sd">        &quot;&quot;&quot;</span>

        <span class="k">if</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">number</span> <span class="o">-</span> <span class="n">previous_entry</span><span class="o">.</span><span class="n">number</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mh">0xFFFF</span> <span class="o">!=</span> <span class="mi">1</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;previous_entry has wrong number!&quot;</span><span class="p">)</span>

        <span class="n">digest</span> <span class="o">=</span> <span class="n">sha256</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">+</span> <span class="n">previous_entry</span><span class="o">.</span><span class="n">digest</span><span class="p">)</span><span class="o">.</span><span class="n">digest</span><span class="p">()[:</span><span class="mi">16</span><span class="p">]</span>
        <span class="k">return</span> <span class="n">constant_time</span><span class="o">.</span><span class="n">bytes_eq</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">digest</span><span class="p">,</span> <span class="n">digest</span><span class="p">)</span></div></div>
</pre></div>

           </div>
           
          </div>
          <footer>

  <hr/>

  <div role="contentinfo">
    <p>
        &#169; Copyright 2018, Yubico.

    </p>
  </div>
    
    
    
    Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
    
    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
    
    provided by <a href="https://readthedocs.org">Read the Docs</a>. 

</footer>
        </div>
      </div>

    </section>

  </div>
  

  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>